5 ms·

So in summary, people who amazon trusts to have access to sensitive private information have access to sensitive private information? i'm not sure why location

So in summary, people who amazon trusts to have access to sensitive private information have access to sensitive private information? i'm not sure why location is the scary part here, i'm more concerned that real people and not just algorithms have access to my audio recordings or transcripts from alexa.

snazz 8y ago
It’s location plus recordings that’s potentially very useful to someone nefarious or for otherwise violating your privacy.
- tastroder 8y ago
  Tidbit: the plural "recordings" implies access to the user's history. That's not supported by the article as far as I can see and would honestly surprise me given the task of transcription/data quality assurance and the current performance of these smart assistants.
  - sagebird 8y ago
    You are not incorrect but if someone gained access multiple recordings, and recordings have location data, if they gather two or more from the same person, they can piece together the history to the extent of how many recordings they capture from the same location. So the history need not be explicitly served up in a tidy package.
    - tastroder 8y ago
      True, I guess it just sounds a little too hypothetical as a scenario for my taste given both Alexa's and Amazon's scale. Don't get me wrong, I still absolutely think the conversation is important and will hopefully lead to a way to deal with these requirements responsibly. These systems aren't going away and it's not like this is something unique to Amazon or even smart assistants. Not sure why we as a sector haven't had the discussion to this depth after e.g. search engines started experimenting with user query logs, the content could be used similarly harmful - and the techniques were/are likely similar.
      - sagebird 8y ago
        I am more pessimistic. When discussions of securing user data come up, how often do people vote - limit lifetime of collected data and delete it after x days? I don’t think businesses ever choose that because they don’t want to commit to the lost opportunity to mine that data later. So what we are stuck with is security through some ad hoc set of encryption and distribution practices- ie only let the transcribers have random access to a small set of data. But then years later we discover the whole dataset is hacked, leaked or accidentally publically accessible and the only thing that would have guaranteed to protect us was - systematically deleting data, the thing they will never do.
      - sagebird 8y ago
        For the transcriptions to be useful they will ultimately be aggregated in some sort of data set so the analysts can have at it. So even if they somehow guaranteed the security of the raw recordings the very nature of data analysis means that somewhere there is going to be an organized collection of this data ripe for abuse if exfiltrated.
noja 8y ago
No, people who Amazon trust to have access to voice information also have access to other information by default and automatically with no extra work.
- WillPostForFood 8y ago
  You have to have an amazon account to use Alexa, so you've already established a relationship with Amazon that would include your name, email address, IP address(location).
  - dx87 8y ago
    That doesn't matter, restricting information that employees can access is Security 101. I can't view restricted company information that I don't need for my job, likewise people transcribing Alexa voice commands don't need the home address of the voices they are transcribing. Just because you give Amazon your address for shipping and billing information doesn't mean you want to give John and Jane on the Alexa QA team your home address.
    - milkytron 8y ago
      It is security 101, the sad part is how bad companies fail at this. I worked a company with over a trillion dollars in assets that had hundreds of “highly confidential” (their own words for classification) that were available to anyone on the network. I took all the appropriate courses of action to report, no action on their end. Reported it to the teams responsible and offered a solution, no action. I debated blowing a whistle and making an example, but I didn’t feel like I’d be safe. This post even makes me paranoid.
    - rmc 8y ago
      I'm pretty sure credit card details aren't shared to all Amazon employees.
  - locations 8y ago
    IP address is by no means an assurance of current, accurate physical location. In the sense that country and state or province might be close enough, it's certainly not accurate enough to nail down county, or zip code level accuracy with more than a coin flip's reliability. Some IP addresses are well known, and bound to physical locations like places of business, retail store fronts, starbucks wi-fi, but that's not really the purview of home assistants, when discussing the meat of these services and their intentions.
theclaw 8y ago
I think the fact that it's audio recordings makes it seem more emotive and intimate than plain text. It's like when you're on the phone to some robot booking service and a real person takes over you're suddenly embarrassed to have been talking to the robot at all.
deleted 8y ago
[deleted]
watertom 8y ago
At best the development team might need to know the state and city. When trying to improve the accuracy it might be helpful when to know where someone lives in order to fix geographically related mis-matches. This is just very sloppy/lazy security.

snazz 8y ago

It’s location plus recordings that’s potentially very useful to someone nefarious or for otherwise violating your privacy.

tastroder 8y ago
Tidbit: the plural "recordings" implies access to the user's history. That's not supported by the article as far as I can see and would honestly surprise me given the task of transcription/data quality assurance and the current performance of these smart assistants.
- sagebird 8y ago
  You are not incorrect but if someone gained access multiple recordings, and recordings have location data, if they gather two or more from the same person, they can piece together the history to the extent of how many recordings they capture from the same location. So the history need not be explicitly served up in a tidy package.
  - tastroder 8y ago
    True, I guess it just sounds a little too hypothetical as a scenario for my taste given both Alexa's and Amazon's scale. Don't get me wrong, I still absolutely think the conversation is important and will hopefully lead to a way to deal with these requirements responsibly. These systems aren't going away and it's not like this is something unique to Amazon or even smart assistants. Not sure why we as a sector haven't had the discussion to this depth after e.g. search engines started experimenting with user query logs, the content could be used similarly harmful - and the techniques were/are likely similar.
    - sagebird 8y ago
      I am more pessimistic. When discussions of securing user data come up, how often do people vote - limit lifetime of collected data and delete it after x days? I don’t think businesses ever choose that because they don’t want to commit to the lost opportunity to mine that data later. So what we are stuck with is security through some ad hoc set of encryption and distribution practices- ie only let the transcribers have random access to a small set of data. But then years later we discover the whole dataset is hacked, leaked or accidentally publically accessible and the only thing that would have guaranteed to protect us was - systematically deleting data, the thing they will never do.
    - sagebird 8y ago
      For the transcriptions to be useful they will ultimately be aggregated in some sort of data set so the analysts can have at it. So even if they somehow guaranteed the security of the raw recordings the very nature of data analysis means that somewhere there is going to be an organized collection of this data ripe for abuse if exfiltrated.

noja 8y ago

No, people who Amazon trust to have access to voice information also have access to other information by default and automatically with no extra work.

WillPostForFood 8y ago
You have to have an amazon account to use Alexa, so you've already established a relationship with Amazon that would include your name, email address, IP address(location).
- dx87 8y ago
  That doesn't matter, restricting information that employees can access is Security 101. I can't view restricted company information that I don't need for my job, likewise people transcribing Alexa voice commands don't need the home address of the voices they are transcribing. Just because you give Amazon your address for shipping and billing information doesn't mean you want to give John and Jane on the Alexa QA team your home address.
  - milkytron 8y ago
    It is security 101, the sad part is how bad companies fail at this. I worked a company with over a trillion dollars in assets that had hundreds of “highly confidential” (their own words for classification) that were available to anyone on the network. I took all the appropriate courses of action to report, no action on their end. Reported it to the teams responsible and offered a solution, no action. I debated blowing a whistle and making an example, but I didn’t feel like I’d be safe. This post even makes me paranoid.
  - rmc 8y ago
    I'm pretty sure credit card details aren't shared to all Amazon employees.
- locations 8y ago
  IP address is by no means an assurance of current, accurate physical location. In the sense that country and state or province might be close enough, it's certainly not accurate enough to nail down county, or zip code level accuracy with more than a coin flip's reliability. Some IP addresses are well known, and bound to physical locations like places of business, retail store fronts, starbucks wi-fi, but that's not really the purview of home assistants, when discussing the meat of these services and their intentions.

theclaw 8y ago

I think the fact that it's audio recordings makes it seem more emotive and intimate than plain text. It's like when you're on the phone to some robot booking service and a real person takes over you're suddenly embarrassed to have been talking to the robot at all.

deleted 8y ago

[deleted]

watertom 8y ago

At best the development team might need to know the state and city. When trying to improve the accuracy it might be helpful when to know where someone lives in order to fix geographically related mis-matches. This is just very sloppy/lazy security.